The vulnerability is a memory leak in the Linux kernel’s DRM/xe subsystem, occurring when the function xe_dma_buf_init_obj() fails to free a pre‑allocated buffer object. The unreleased buffer is owned by the kernel and is not reclaimed on error paths, so repeated failures accumulate kernel memory usage. This leakage can lead to gradual exhaustion of critical kernel memory resources, potentially destabilizing the system or causing a denial of service.

The flaw exists in any kernel that includes the Linux DRM/xe code path before the commit referenced in the advisory (78a6c5f899f22338bbf48b44fb8950409c5a69b9). Kernels that have not yet merged this change are affected, regardless of the specific distribution or version. There is no indication that only particular kernel configurations are impacted; the leak is present in the common code path for DMA buffer initialization via DRM ioctls.

The bug is exploitable only in environments where a process can invoke DRM DMA buffer initialization through privileged interface calls. The attack does not grant arbitrary code execution but can be leveraged for local resource exhaustion. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. With no disclosed CVSS score, the severity is inferred to be medium to high based on the potential for kernel memory depletion and the likelihood that an attacker may trigger repeated failures through crafted inputs.